Funding is a Treasury word. Contracted is the one that pays the wages.

On Wednesday 28 October the Chancellor fully funded the Defence Investment Plan. The £4.7bn that June's plan left blank has been found by "reprioritising public spending", which is the Treasury's phrase for moving money between departments. No new money, but the gap is closed and the MOD can get on with it. Relief first.

Then a shrug. In June I argued the MOD couldn't afford to build software the old way. In July I wrote that the plan added £15bn and still left the gap open. Now the money is confirmed, and I'm not going to pretend it changes much for anyone who writes software for defence, because the cost that matters was never in the Budget. It sits in the process that turns a funded line into a signed contract. Funding is a Treasury word. Contracted is the one that pays the wages.

Where the two years go

Start with the MOD's own numbers. Until this spring, the average time from a requirement being identified to a supplier being put under contract was six years for a major platform and three years for an upgrade to communications, sensors or weapons. That is the time before anyone builds anything. On 1 April the National Armaments Director Group launched a segmented approach to procurement with three lanes and three targets: two years for major platforms, one year for upgrades, and three months for "rapid commercial exploitation", which the minister illustrated with uncrewed systems. The Budget's "time to contract cut by two-thirds" is the six-to-two.

Three lanes, and software isn't named in any of them. In practice it gets bought as a component of whichever platform or upgrade it ships with, so it inherits that lane. A system we could build in weeks sits in a queue designed for frigates.

Not because software is hard to build. In my experience the build is the quick part. The time and the cost sit in everything wrapped around it: the business case, the approvals, the commercial route, the security case, the contract, and then a bid somebody has to write and somebody else has to mark. Each of those steps is owned by a person who will never use the product and who carries the risk if it goes wrong. Put yourself in the Senior Responsible Owner's chair. Deploy something quickly and watch it fail, and that's a career event. Take two years and deliver late, and that's a Tuesday. The incentives reward caution, so caution is what we get.

The Americans changed the process, not just the budget

Washington has the same disease and decided the cure was procedural. In March 2025 the Pentagon made its Software Acquisition Pathway, created in 2020 on the principle that software shouldn't be bought the way you buy an aircraft or a ship, the preferred route for every software component of a weapons or business system. It made Commercial Solutions Openings and Other Transaction agreements, the quick instruments the Defense Innovation Unit had been using with start-ups for years, the default way to solicit and award. And it forbade the services from layering their own restrictions back on top.

In April the Pentagon's CIO launched Software Fast Track, aimed at the authorisation bottleneck rather than the buying one. The old Risk Management Framework and its authority-to-operate paperwork were, in the CIO's words, archaic. The replacement is continuous authorisation: evidence pulled from the build pipeline and read by tools, not a binder waiting for a human. It began as a 90-day sprint.

Then last November the whole system was renamed the Warfighting Acquisition System. The memo's diagnosis of why delivery was slow could have been written about Whitehall: no single accountable leader, and "broken incentives that reward completely satisfying every requirement" at the cost of delivering on time. Programme offices are being folded into portfolio executives with authority over requirements, money and acquisition inside their portfolio, scorecards that measure time from validated need to capability in the field, removal for chronic schedule slips, and pay for taking sensible risk. Commercial products became the default policy. By this summer the Air Force had finished reorganising around them.

None of that makes America a model of restraint, and plenty of its programmes are still stuck. But look at the shape of it. Software got its own pathway, its own contracting instruments and its own authorisation model, and the people buying it are now measured on speed. In Britain, software got a lane it has to share with the platform it ships on.

Slow is the expensive part

Slow is not a neutral cost. It's a multiplier. A two-year route to contract means two years of bid cost that gets priced back into the job, two years in which the requirement drifts and the people who wrote it move on, and two years for the technology to date. The MOD's own reasoning for the three-month lane is that the useful life of a small drone design is now measured in months. Software isn't far behind. The government measured the benefit of AI coding assistants in minutes saved per developer per day, while its contracting still runs in years. You don't need a spreadsheet to see which number matters.

Then there's the gate at the end. Nothing I can find in the Budget touches Secure by Design, and that's what every pound of software money passes through: an assessment at least every three months, with the MOD's own tracker holding the assessment but not the evidence. You keep the evidence separately and produce it when asked. That is precisely the paperwork problem the Americans decided to automate, and it's the problem Signal Coding was set up for, so I'll be plain. The AI writes. A separate process reviews, and the two never share a chair. Nothing goes out without evidence that it was tested, scanned and signed off, and that evidence is produced while the code is being built rather than reconstructed afterwards. Our orchestrator won't let a change through without the record, so on the day the software exists, the Secure by Design pack exists with it. Security-cleared engineers in charge of the AI, not the other way round. Continuous assurance, before anyone asks for it.

What to do while the lanes are repainted

For the MOD, the ask is small. Give software its own segment and put it in the three-month one. Match the authorisation to that pace, and buy evidence rather than documents. The Armaments Director Group has already written the pathways. Software just needs to be allowed to use them.

For the MD of a defence SME reading this tonight: don't write to your MP about the Budget. Ring the prime you already work with and ask two questions. Which of the roughly 370 contracts the Budget cites, worth over £2.7bn, did you win, and what do you need subcontracted in the next six months? Then spend the quarter becoming the easiest company in that supply chain to buy from. Secure by Design evidence ready before anyone asks. Clearances current. A price you can quote in days. If software is what's stopping you saying yes, treat it as a twelve-week problem, because that's what it is now. The two-year clock belongs to the process. It doesn't have to belong to you.

References

• HM Treasury, Budget 2026, 28 October 2026, national security section, paragraphs 5.28 to 5.32: Defence Investment Plan fully funded by reprioritising public spending; around 370 contracts worth over £2.7bn; time to contract cut by two-thirds for major platforms under the National Armaments Director
• HM Treasury, The Defence Investment Plan funding explainer, 30 June 2026: £10.3bn identified, £4.7bn to be confirmed at Budget 2026
• Luke Pollard, written answer on the segmented approach to procurement, reported by UK Defence Journal, 3 September 2026: launched 1 April 2026; major platforms six years to two; upgrades three years to one; rapid commercial exploitation three months; six Commercial Pathways
• Defense News, 7 March 2025: memo of 6 March 2025 making the Software Acquisition Pathway the preferred route, with Commercial Solutions Openings and Other Transactions as the default
• DefenseScoop, 29 April 2025, and Federal News Network, May 2025: Software Fast Track, continuous authority to operate, the Risk Management Framework described as archaic
• DefenseScoop, 7 November 2025: Warfighting Acquisition System memo; "broken incentives" diagnosis; Portfolio Acquisition Executives; scorecards on time from validated need to capability; incentive pay; commercial products as default policy
• DefenseScoop, 6 August 2026: Air Force completes its portfolio executive reorganisation
• MOD, Secure by Design, "Do regular assessments": assessment cadence and the CAAT, which does not accept uploaded evidence
• Government Digital Service, AI Coding Assistant Trial findings, 12 September 2025: average 56 minutes saved per developer per working day
• Earlier in this series: The MOD Can't Afford to Build Software the Old Way Anymore (June 2026) and We Said the MOD Couldn't Afford the Old Way. The Defence Investment Plan Proved It. (July 2026)

---

Is the contract clock, not the build, what's slowing your software down? Contact our security-cleared team.